From 95b8ce2936289b618b8e8e803f76398507eea782 Mon Sep 17 00:00:00 2001
From: jbergner <jbergner@send.nrw>
Date: Mon, 27 Apr 2026 22:29:52 +0200
Subject: [PATCH] Bugfix

---
 main.go | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/main.go b/main.go
index 47cfb77..c0603ea 100644
--- a/main.go
+++ b/main.go
@@ -2126,22 +2126,32 @@ func eventListSummary(ev EventRow) string {
 }
 
 func (s *server) listSOCRecentIncidents(ctx context.Context, limit int) ([]SOCRecentIncidentRow, error) {
+	if limit <= 0 || limit > 500 {
+		limit = 50
+	}
+
 	rows, err := s.db.QueryContext(ctx, `
 SELECT id, created_at, rule_name, severity, status, hostname, summary
 FROM (
     SELECT id, created_at, rule_name, severity, status, hostname, summary
-    FROM detections
-    WHERE status IN ('open', 'investigating', 'confirmed_incident')
-    ORDER BY created_at DESC
-    LIMIT ?
+    FROM (
+        SELECT id, created_at, rule_name, severity, status, hostname, summary
+        FROM detections
+        WHERE status IN ('open', 'investigating', 'confirmed_incident')
+        ORDER BY created_at DESC
+        LIMIT ?
+    ) s
 
-    UNION DISTINCT
+    UNION
 
     SELECT id, created_at, rule_name, severity, status, hostname, summary
-    FROM detections
-    WHERE severity IN ('high', 'critical')
-    ORDER BY created_at DESC
-    LIMIT ?
+    FROM (
+        SELECT id, created_at, rule_name, severity, status, hostname, summary
+        FROM detections
+        WHERE severity IN ('high', 'critical')
+        ORDER BY created_at DESC
+        LIMIT ?
+    ) sev
 ) x
 ORDER BY created_at DESC
 LIMIT ?
@@ -2165,6 +2175,7 @@ LIMIT ?
 		); err != nil {
 			return nil, err
 		}
+
 		r.CreatedAt = normalizeTime(r.CreatedAt)
 		out = append(out, r)
 	}